Recently I got a mail from firebase in which they told me that all requests from clients are declined after 4 days and to update my security rule.
In my app, there is no need for logging, anyone can download and play quizzes but I did not allow anyone to write to the database. I manually update the database.
So please suggest to me what rule am I use to avoid that request decline problem.
My realtime database rules are-
"rules": {
".read": true,
".write": false
}
and storage rules are-
rules_version = '2';
service firebase.storage {
match /b/{bucket}/o {
match /{allPaths=**} {
allow read, write: if request.auth != null;
}
}
}
you can try if
rules_version = '2';
service firebase.storage {
match /b/{bucket}/o {
match /{allPaths=**} {
allow read, write;
}
}
}
Related
Please can someone help me with this error from firebaseStorage?
Caused by: java.io.IOException: { "error": { "code": 400, "message": "Your bucket has not been set up properly for Firebase Storage. Please visit 'https://console.firebase.google.com/project/task-management-app-99c32/storage/files' to automatically repair this issue and then retry. If the issue lasts longer than five minutes, you may have insufficient permissions to repair the project. You can check your permissions by visiting 'https://console.firebase.google.com/iam-admin/iam/project?project=task-management-app-99c32'." }}
You can change your Firebase Storage rules to be as follows:
rules_version = '2';
service firebase.storage {
match /b/{bucket}/o {
match /{allPaths=**} {
allow read, write: if request.auth != null;
}
}
}
Change Storage rules of firebase
rules_version = '2';
service firebase.storage {
match /b/{bucket}/o {
match /{allPaths=**} {
allow read, write: if true; // true
}
}
}
You can change Realtime database rules
{
"rules" : {
".read" : true,
".write" : true
}
}
I know that questions about Firestore permission errors have been asked a lot, but my situation may be unique. This is because of three things:
my database is in test mode which should allow access to anyone (right?)
I am getting the error while simulating my app with an authenticated firebase user
I am able to write data--the error only happened while reading it.
Here are my security rules:
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read, write: if
request.time < timestamp.date(2021, 12, 31);
}
}
}
Here is a screenshot of a description of Firestore's test database mode:
The actual error I got was this:
Error: Error Domain=FIRStorageErrorDomain Code=-13021 "User does not have permission
to access gs://zimmerfour.appspot.com/senderID." UserInfo={object=senderID,
ResponseBody={
"error": {
"code": 403,
"message": "Permission denied. Please enable Firebase Storage for your bucket by visiting the Storage tab in the Firebase Console and ensure that you have sufficient permission to properly provision resources."
EDIT:
I haven't changed the overall Cloud Storage rules. They are still set to the default of:
service firebase.storage {
match /b/{bucket}/o {
match /{allPaths=**} {
allow read, write: if request.auth != null;
}
}
}
The error message is coming from Cloud Storage for Firebase (as indicated by FIRStorageErrorDomain and the error message), which is protected by its own set of security rules in your project.
Try this method, it worked for me :)
// if you want to allow for all to read, write
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read, write;
}
}
}
// if you want to allow for all to read, and authenticated users to write
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read;
allow write: if request.auth != null;
}
}
}
// if you want to allow for only authenticated users to write or read
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read, write: if request.auth != null;
}
}
}
I am using Firebase for Auth and image storage--images that are publically available thoughout my app, like profile pictures. How do I set up the permissions appropriately so that any user (or even non-authenticated entities) can read these public images?
My security rules:
rules_version = '2';
service firebase.storage {
match /b/{bucket}/o {
match /{allPaths=**} {
allow read, write: if request.auth != null;
}
}
}
In your question, you say that you want non-authenticated entities to see the images, but your rules are set up to only allow authenticated entities to see them. You can change your rules to:
service firebase.storage {
match /b/{bucket}/o {
match /{allPaths=**} {
allow read;
allow write: if request.auth != null;
}
}
}
Firebase keep telling me
We've detected the following issue(s) with your security rules:
any user can read your entire database
I have changed the rules but that rules doesn’t work in my app because all user can read from db and only authenticate user can write to db.
Firebase says that write and read should be performed until we login. But in my case every user can read and only login user can write.
Any ideas how to solve this ? or I'm I doing it wrong ?
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read;
allow write: if request.auth != null;
}
}
}
Can you set your read to false explicitly?
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read: if false;
allow write: if request.auth != null;
}
}
}
That should do it. Let me know if it persists.
The root cause is that even though you are allowing only authenticated users to read or write but they have access to the whole database as mentioned in the Google Cloud Firestore Documentation. That also means any authenticated user can write anything in your database.
If you database has a separate document for each user, I would suggest using the following rules which allows users to write/read their own data only.
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /users/{userId} {
allow read, write: if request.auth.uid === userId;
}
}
}
I need to set firebase storage rules so unauthenticated users can upload a file but can't read a file.
So far I have:
rules_version = '2';
service firebase.storage {
match /b/{bucket}/o {
match /{allPaths=**} {
allow write: if true
allow read: if false
}
}
}
Is this the correct way to do this?
This rule will help you to read only if user is authenticated else it won't allow. For more details you can read docs
rules_version = '2';
service firebase.storage {
match /b/{bucket}/o {
match /{allPaths=**} {
allow read: if request.auth != null;
allow write: if true;
}
}
}